Pico Zip 4.01 - 'Filename' Local Buffer Overflow

!/usr/bin/perl Pico Zip v. 4.01 Long Filename Buffer Overflow Original advisory - http://www.securityfocus.com/archive/1/437103/30/30/threaded Author - c0rrupt Greets - sh0uts to n0limit, muts, and brax for the music ; The vulnerability is caused due to a boundary error within the "zipinfo.dll"...

CesarFTP 0.99g (MKD) Remote Buffer Overflow Exploit

No description provided by source. !/usr/bin/python CesarFtp 0.99g 0day Exploit Proof of Concept: execute calc.exe Tested on XP sp2 polish Bug found by h07 [email protected] Date: 10.06.2006 from socket import shellcode = execute calc.exe metasploit.com...

CesarFTP 0.99g (MKD) Remote Buffer Overflow Exploit

Exploit for unknown platform in category remote exploits =================================================== CesarFTP 0.99g MKD Remote Buffer Overflow Exploit =================================================== !/usr/bin/python CesarFtp 0.99g 0day Exploit Proof of Concept: execute calc.exe Tested...

CesarFTP 0.99g - MKD Remote Buffer Overflow

CesarFTP 0.99g - MKD Remote Buffer Overflow !/usr/bin/python CesarFtp 0.99g 0day Exploit Proof of Concept: execute calc.exe Tested on XP sp2 polish Bug found by h07 [email protected] Date: 10.06.2006 from socket import shellcode = execute calc.exe...

CesarFTP 0.99g - 'MKD' Remote Buffer Overflow

!/usr/bin/python CesarFtp 0.99g 0day Exploit Proof of Concept: execute calc.exe Tested on XP sp2 polish Bug found by h07 [email protected] Date: 10.06.2006 from socket import shellcode = execute calc.exe "\x31\xc9\x83\xe9\xdb\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xd8"...

PuTTy.exe <= 0.53 (validation) Remote Buffer Overflow Expl (meta)

Exploit for unknown platform in category remote exploits ==================================================================== PuTTy.exe 'PuTTy.exe '$Revision: 1.1 $', 'Authors' = 'y0 at w00t-shell.net' , 'Description' = Pex::Text::Freeformqq This module exploits a buffer overflow in the PuTTY SSH...

Windows 2003 or XP SP2 VPN Detection

Binary data 3564.prm...

Code injection

Microsoft Distributed Transaction Coordinator MSDTC for Windows NT 4.0, 2000 SP4, XP SP1 and SP2, and Server 2003 allows remote attackers to cause a denial of service crash via a BuildContextW request with a large 1 UuidString or 2 GuidIn of a certain length, which causes an out-of-range memory...

[EEYEB20051011A] - Microsoft Distributed Transaction Coordinator Heap Overflow

Microsoft Distributed Transaction Coordinator Heap Overflow http://www.eeye.com/html/research/advisories/AD20060509a.html Release Date: May 9, 2006 Date Reported: October 11, 2005 Patch Development Time In Days: 210 Severity: High Remote Code Execution Systems Affected: Windows NT 4.0 Windows 200...

Microsoft Internet Explorer 6.0.2900 SP2 - CSS Attribute Denial of Service

IE-Crash - By seven header position: fixed; height: 761px; width: 1268; milw0rm.com 2006-05-10...

CVE-2006-0034

Heap-based buffer overflow in the CRpcIoManagerServer::BuildContext function in msdtcprx.dll for Microsoft Distributed Transaction Coordinator MSDTC for Windows NT 4.0 and Windows 2000 SP2 and SP3 allows remote attackers to execute arbitrary code via a long fifth argument to the BuildContextW or...

CVE-2006-1184

CVE-2006-1184 describes a Denial of Service in Microsoft Windows’ Distributed Transaction Coordinator (MSDTC) that could crash the MSDTC service when a remote attacker sends a crafted BuildContextW message with a large UuidString or GuidIn. The issue affects MSDTC on Windows NT 4.0, 2000 SP4, XP ...

CVE-2006-2092

Unspecified vulnerability in HP StorageWorks Secure Path for Windows 4.0C-SP2 before 20060419 allows remote attackers to cause an unspecified denial of service via unknown vectors...

CVE-2006-2056

CVE-2006-2056 affects Internet Explorer 6 on Windows XP SP2. The vuln is an argument-injection flaw where an attacker can influence command line arguments passed to a launched mail client via double-quote characters in a mailto: handler, demonstrated by starting Outlook with an arbitrary attachme...

Microsoft Internet Explorer 6 - Nested OBJECT Tag Memory Corruption

source: https://www.securityfocus.com/bid/17658/info Microsoft Internet Explorer is prone to a memory-corruption vulnerability. This issue is due to a flaw in the application in handling nested OBJECT tags in HTML content. An attacker could exploit this issue via a malicious web page to potential...

win32 Beep Shellcode (SP1/SP2) 35 bytes

Exploit for win32 platform in category shellcode ======================================= win32 Beep Shellcode SP1/SP2 35 bytes ======================================= / Shellcode can be changed to work with any windows distribution by changing the address of Beep in kernel32.dll Addresses for SP1...

win32 Beep Shellcode SP1/SP2 35 bytes

win32 Beep Shellcode SP1/SP2 35 bytes. Shellcode exploit for win32 platform / Shellcode can be changed to work with any windows distribution by changing the address of Beep in kernel32.dll Addresses for SP1 and SP2 -xnull / include unsigned char beepsp1 = "\x55\x89\xE5\x83\xEC\x18\xC7\x45\xFC"...

Ultr@VNC 1.0.1 - client Log::ReallyPrint Remote Buffer Overflow

Ultr@VNC 1.0.1 - client Log::ReallyPrint Remote Buffer Overflow !/usr/bin/python Ultr@VNC 1.0.1 Client Buffer Overflow - Luigi Auriemm POC by Paul Haas at Redspin.com Tested on WinXP SP 2: Launches Calc import socket, struct HOST = '' Localhost PORT = 5900 VNC Server BOFSZ = 1024 Buffer Size HEAD...

Microsoft Internet Explorer Erroneous IOleClientSite Data Zone Bypass Vulnerability

Description Microsoft Internet Explorer is prone to a zone-bypass vulnerability because the browser returns erroneous IOleClientSite when dynamically creating an embedded object. This could cause malicious script code to be executed in a security zone with fewer restrictions than the zone that th...

NOD32 local privilege escalation vulnerability

NOD32 local privilege escalation vulnerability Not affected: Version 2.51.26 Tested on: Winxp sp2 Risk: Average To escalate the system privilage, the option 'quarentine a file' in NOD32 can be exploited & a malicious file can be copied to the quarentine and using the 'restore to...' option it can...